CVE-2026-96355
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal…
- Risk score
- 67/100
- CVSS
- 9.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in Drupal Webform's template engine allows code injection, which could be exploited by an attacker to inject malicious code. This could lead to code execution and potentially allow an attacker to gain control of the system.
- Affected
- {'products': ['Drupal Webform'], 'packages': [], 'versions': ['0.0.0-6.2.12', '6.3.0-6.3.1']}
- Fix
- Upgrade to version 6.2.13 or later
- Exploitation
- No known exploitation
Not confirmed. 6.2.13 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Last activity 22 Oct 2026. Patch Forecast updates every hour.